CVE-2026-88880
Renovate versions older than 44.11.3 do not check the Link header when following GitLab pagination. This allows a malicious GitLab server to redirect requests that contain credentials to an attacker-controlled site, leaking authentication data. The flaw is exploitable without any user interaction.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running Renovate before version 44.11.3, especially those integrating with GitLab.
Real-world impact
An attacker who controls a compromised GitLab server can redirect credential-bearing requests to a malicious server, capturing authentication credentials used by Renovate.
Why this severity
The CVSS score of 9.2 reflects that the vulnerability is exploitable over the network, requires no authentication, and can lead to complete credential theft, which is a high impact.
What to do about it
- 01Upgrade Renovate to version 44.11.3 or later.
- 02Restart the Renovate service to apply the update.
NVD description
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.